Live › vulnerability › CVE-2026-116095
Go to dashboardThe smg project's llm-multimodal component decodes JPEG images in jpeg_turbo::decode_jpeg_rgb without limiting memory allocation, so a crafted image can make the process allocate excessive memory. A remote attacker can use the publicly available exploit to degrade or crash the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 23:36 UTC. All times on this page are UTC.
Teams running smg 1.7.0 through 1.10.1 that accept image inputs for multimodal requests are exposed, because the flaw is in the JPEG decode path. Deployments that do not process images through llm-multimodal, or that already run 1.11.0, are not affected. Whether a specific deployment reaches the vulnerable code path beyond that is unknown from the sources.
No product ranges from the sources yet.
smg --version or the lockfile entry) and see whether it is one of 1.7.0, 1.8.0, 1.9.0, 1.10.0 or 1.10.1.1.11.0, which includes patch commit 8f51b57e219a914089e345b704c3c8de37a3bb8e.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-116095")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.